Add swarmpit

README.md

@@ -13,13 +13,16 @@ A good-looking 2D adventure.
 
 ## Todo
 
+- host script
+  - https://github.com/ottomatica/slim
+  - rancher os
 - Frontend nginx disable logging
 - procedural piano
 - obfuscate function names
 - lightweight object storage
-- docker engine dashboard?
 - dockerswarm.rocks
 - local dev env
-- prettier script
+- CI pipeline:
-- monitoring
+  - prettier script
-- traefik
+  - tests?
+- monitoring: https://dockerswarm.rocks/swarmpit/

infrastructure/add-swarmpit.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+DOMAIN=swarmpit.decla.red
+NODE_ID=$(docker info -f '{{.Swarm.NodeID}}')
+docker node update --label-add swarmpit.db-data=true $NODE_ID
+docker node update --label-add swarmpit.influx-data=true $NODE_ID
+docker stack deploy -c docker-compose.swarmpit.yml swarmpit

infrastructure/docker-compose.swarmpit.yml

@@ -0,0 +1,93 @@
+version: "3.3"
+
+# source: https://raw.githubusercontent.com/swarmpit/swarmpit/master/docker-compose.yml
+
+services:
+  app:
+    image: swarmpit/swarmpit:latest
+    environment:
+      - SWARMPIT_DB=http://db:5984
+      - SWARMPIT_INFLUXDB=http://influxdb:8086
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    ports:
+      - "8080"
+    networks:
+      - network
+    deploy:
+      resources:
+        limits:
+          cpus: "0.15"
+          memory: 256M
+        reservations:
+          cpus: "0.15"
+          memory: 256M
+      placement:
+        constraints:
+          - node.role == manager
+
+  db:
+    image: couchdb:2.3.0
+    volumes:
+      - db-data:/opt/couchdb/data
+    networks:
+      - network
+    deploy:
+      resources:
+        limits:
+          cpus: "0.05"
+          memory: 64M
+        reservations:
+          cpus: "0.05"
+          memory: 64M
+      placement:
+        constraints:
+          - node.labels.swarmpit.db-data == true
+
+  influxdb:
+    image: influxdb:1.7
+    volumes:
+      - influx-data:/var/lib/influxdb
+    networks:
+      - network
+    deploy:
+      resources:
+        limits:
+          cpus: "0.05"
+          memory: 64M
+        reservations:
+          cpus: "0.05"
+          memory: 64M
+      placement:
+        constraints:
+          - node.labels.swarmpit.influx-data == true
+
+  agent:
+    image: swarmpit/agent:latest
+    environment:
+      - DOCKER_API_VERSION=1.35
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - network
+    deploy:
+      mode: global
+      labels:
+        swarmpit.agent: "true"
+      resources:
+        limits:
+          cpus: "0.10"
+          memory: 64M
+        reservations:
+          cpus: "0.05"
+          memory: 32M
+
+networks:
+  network:
+    driver: overlay
+
+volumes:
+  db-data:
+    driver: local
+  influx-data:
+    driver: local

infrastructure/docker-compose.yml

@@ -5,8 +5,10 @@ services:
     init: true
     image: ${CONTAINER_REGISTRY}/declared-ingress
     depends_on:
-      - certbot
       - frontend
+    networks:
+      - swarmpit_network
+      - network
     deploy:
       replicas: 2
       resources:
@@ -29,34 +31,15 @@ services:
       - "443:443"
     command: '/bin/sh -c ''while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"'''
     volumes:
-      - /root/data/certbot/conf:/etc/letsencrypt
+      - /etc/letsencrypt:/etc/letsencrypt
-      - /root/data/certbot/www:/var/www/certbot
-
-  certbot:
-    init: true
-    image: certbot/certbot
-    deploy:
-      replicas: 1
-      resources:
-        limits:
-          cpus: "0.05"
-          memory: 64M
-        reservations:
-          cpus: "0.05"
-          memory: 64M
-      restart_policy:
-        condition: on-failure
-        window: 30s
-    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
-    volumes:
-      - /root/data/certbot/conf:/etc/letsencrypt
-      - /root/data/certbot/www:/var/www/certbot
 
   frontend:
     init: true
     image: ${CONTAINER_REGISTRY}/declared-frontend
     ports:
       - "80"
+    networks:
+      - network
     deploy:
       replicas: 2
       resources:
@@ -74,3 +57,10 @@ services:
       restart_policy:
         condition: on-failure
         window: 30s
+
+networks:
+  network:
+    driver: overlay
+
+  swarmpit_network:
+    external: true

infrastructure/init-letsencrypt.sh

@@ -1,66 +1,14 @@
 #!/bin/bash
 
-# Source https://medium.com/@pentacent/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71
+sudo apt-get install certbot python3-certbot-dns-digitalocean -y
 
-domains=(decla.red)
+certbot certonly \
-rsa_key_size=4096
+  --dns-digitalocean \
-data_path="./data/certbot"
+  --dns-digitalocean-credentials ~/digitalocean.api.key \
-email="schmelczerandras@gmail.com" # Adding a valid address is strongly recommended
+  --dns-digitalocean-propagation-seconds 120 \
+  -m "schmelczerandras@gmail.com" \
+  -d "decla.red" -d "*.decla.red" \
+  --agree-tos
 
-if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then
+curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "/etc/letsencrypt/options-ssl-nginx.conf"
-  echo "### Downloading recommended TLS parameters ..."
+curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "/etc/letsencrypt/ssl-dhparams.pem"
-  mkdir -p "$data_path/conf"
-  curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf"
-  curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem"
-  echo
-fi
-
-echo "### Creating dummy certificate for $domains ..."
-path="/etc/letsencrypt/live/$domains"
-mkdir -p "$data_path/conf/live/$domains"
-docker-compose run --rm --entrypoint "\
-  openssl req -x509 -nodes -newkey rsa:1024 -days 1\
-    -keyout '$path/privkey.pem' \
-    -out '$path/fullchain.pem' \
-    -subj '/CN=localhost'" certbot
-echo
-
-
-echo "### Starting nginx ..."
-docker-compose up --force-recreate -d ingress
-echo
-
-echo "### Deleting dummy certificate for $domains ..."
-docker-compose run --rm --entrypoint "\
-  rm -Rf /etc/letsencrypt/live/$domains && \
-  rm -Rf /etc/letsencrypt/archive/$domains && \
-  rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot
-echo
-
-
-echo "### Requesting Let's Encrypt certificate for $domains ..."
-#Join $domains to -d args
-domain_args=""
-for domain in "${domains[@]}"; do
-  domain_args="$domain_args -d $domain"
-done
-
-
-# Select appropriate email arg
-case "$email" in
-  "") email_arg="--register-unsafely-without-email" ;;
-  *) email_arg="--email $email" ;;
-esac
-
-docker-compose run --rm --entrypoint "\
-  certbot certonly --webroot -w /var/www/certbot \
-    $staging_arg \
-    $email_arg \
-    $domain_args \
-    --rsa-key-size $rsa_key_size \
-    --agree-tos \
-    --force-renewal" certbot
-echo
-
-echo "### Reloading nginx ..."
-docker-compose exec ingress ingress -s reload

infrastructure/init-remote.sh

@@ -1,6 +0,0 @@
-#!/bin/bash
-
-REMOTE_ADDRESS=$1
-echo Initializing new machine, $REMOTE_ADDRESS
-
-cat init-remote.sh | ssh $REMOTE_ADDRESS

ingress/nginx-config/nginx.conf

@@ -22,34 +22,18 @@ http {
 
     server {
         listen 80;
-        server_name decla.red;
+        server_name *.decla.red decla.red;
         server_tokens off;
 
-        location /.well-known/acme-challenge/ {
-            root /var/www/certbot;
-        }
-
         location / {
             return 301 https://$host$request_uri;
         }
     }
 
     server {
-        listen 443 ssl;
+        server_name decla.red default_server;
-        server_name decla.red;
-        server_tokens off;
         
-        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        include /etc/nginx/ssl-server.conf;
-
-        ssl_certificate /etc/letsencrypt/live/decla.red/fullchain.pem;
-        ssl_certificate_key /etc/letsencrypt/live/decla.red/privkey.pem;
-        include /etc/letsencrypt/options-ssl-nginx.conf;
-        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-        location ~ ^/(502).html$ {
-            root /usr/share/nginx/html/errors;
-            internal;
-        }
 
         location / {
             proxy_pass  http://frontend;
@@ -57,7 +41,18 @@ http {
             proxy_set_header    X-Real-IP           $remote_addr;
             proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
         }
+    }
 
-        error_page 502 /502.html;
+    server {
+        server_name swarmpit.decla.red;
+        
+        include /etc/nginx/ssl-server.conf;
+
+        location / {
+            proxy_pass  http://app:8080;
+            proxy_set_header    Host                $http_host;
+            proxy_set_header    X-Real-IP           $remote_addr;
+            proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
+        }
     }
 }

ingress/nginx-config/ssl-server.conf

@@ -0,0 +1,17 @@
+listen 443 ssl;
+
+server_tokens off;
+
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+ssl_certificate /etc/letsencrypt/live/decla.red/fullchain.pem;
+ssl_certificate_key /etc/letsencrypt/live/decla.red/privkey.pem;
+include /etc/letsencrypt/options-ssl-nginx.conf;
+ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+location ~* ^/(502).html$ {
+    root /usr/share/nginx/html/errors;
+    internal;
+}
+
+error_page 502 /502.html;